EP3398289B1 - Verfahren, system und vorrichtung mit vorwärtssicherer kryptografie zur passcodeüberprüfung - Google Patents
Verfahren, system und vorrichtung mit vorwärtssicherer kryptografie zur passcodeüberprüfung Download PDFInfo
- Publication number
- EP3398289B1 EP3398289B1 EP16826678.1A EP16826678A EP3398289B1 EP 3398289 B1 EP3398289 B1 EP 3398289B1 EP 16826678 A EP16826678 A EP 16826678A EP 3398289 B1 EP3398289 B1 EP 3398289B1
- Authority
- EP
- European Patent Office
- Prior art keywords
- value
- client
- authentication
- server
- state variable
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims description 96
- 238000012795 verification Methods 0.000 title claims description 15
- 230000006870 function Effects 0.000 claims description 192
- 230000002427 irreversible effect Effects 0.000 claims description 71
- 238000004364 calculation method Methods 0.000 claims description 23
- 230000003993 interaction Effects 0.000 claims description 13
- 238000012545 processing Methods 0.000 claims description 13
- 238000009795 derivation Methods 0.000 claims description 10
- 238000004422 calculation algorithm Methods 0.000 description 40
- 238000001994 activation Methods 0.000 description 17
- 230000004913 activation Effects 0.000 description 15
- 230000004044 response Effects 0.000 description 12
- 230000009471 action Effects 0.000 description 11
- 230000008859 change Effects 0.000 description 4
- 238000004891 communication Methods 0.000 description 4
- 230000003287 optical effect Effects 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 230000008901 benefit Effects 0.000 description 3
- 238000013475 authorization Methods 0.000 description 2
- 238000012790 confirmation Methods 0.000 description 2
- 230000002441 reversible effect Effects 0.000 description 2
- 230000001360 synchronised effect Effects 0.000 description 2
- 238000003491 array Methods 0.000 description 1
- 230000000295 complement effect Effects 0.000 description 1
- 230000001010 compromised effect Effects 0.000 description 1
- 238000013478 data encryption standard Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 238000007620 mathematical function Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 239000002184 metal Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/067—Network architectures or network communication protocols for network security for supporting key management in a packet data network using one-time keys
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
- H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0877—Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
- H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/04—Masking or blinding
Definitions
- the invention relates to securing remote access to computers and applications and remote transactions over computer networks. More specifically, the invention relates to methods, apparatus and systems for using a secret passcode with a two-factor authentication token.
- a user may be authenticated to, for example, a computer based application by a person claiming to be the legitimate user providing to an authentication verifying entity proof of two authentication factors.
- a first factor (the 'what the user has' factor) consists of a proof that the user possesses or has access to a specific object or token that may be linked or associated with a particular user.
- a second factor may consist of a proof that the user has knowledge of a specific piece of information that may be linked or associated with a particular user (the 'what the user knows' factor).
- This specific piece of information may comprise a secret that may be assumed to be known by no other person than the legitimate user, such as a secret password or a secret PIN (Personal Identification Number). This specific piece of information may be referred to in the remainder of this description as a passcode.
- US8832807B1 relates to generation of OTPs.
- the invention is based on an insight of the inventors that client and server devices that are used for authentication purposes may be hacked so that information stored on these devices may fall in the hands of fraudsters. If this stolen information is related to passcodes that users may use when authenticating to a computer based application, a risk exists that this stolen information may be used by some fraudulent party to extract knowledge about these passcodes, for example to retrieve the passcodes themselves. Since in some cases a user may use the same or similar passcodes across multiple platforms and applications, the damage that could arise from the discovery by malicious parties of such passcodes may extend well beyond the single computer based application. It may for example in practice be difficult to exclude that users of an internet banking application will choose a passcode for authenticating to that internet banking application that is identical or very similar to the PIN of one of their bank cards.
- client devices may permanently store any information that may permit an attacker to retrieve the value of a passcode or to constrain the range of possible values of a passcode.
- neither the client devices nor the server devices may permanently store a passcode value or a data element that is calculated in a reversible way from a passcode value.
- client devices may also be referred to as clients, authentication clients, authentication tokens or strong authentication tokens.
- the strong authentication token may be adapted to generate dynamic credentials such as a one-time password (OTP) or an electronic signature by cryptographically combining a value of a passcode verifier data element with the value of a dynamic variable and the value of a secret cryptographic key and using a cryptographic algorithm that is parameterized with the secret cryptographic key.
- OTP one-time password
- OTP electronic signature
- the strong authentication token may be adapted to calculate the value of the passcode verifier data element by prompting the user to provide a passcode and by combining the passcode value provided by the user with the value of a passcode-blinding data element.
- the passcode-blinding data element may be stored by the authentication token, e.g., in some form of permanent or non-volatile memory accessible by the authentication token.
- the passcode value provided by the user may be combined with the value of a stored passcode-blinding data element by using a function such as a cryptographic one-way function which may for example comprise a cryptographic hashing function.
- the passcode-blinding data element may be generated once by the strong authentication token and may then be stored by the strong authentication token for future use.
- the strong authentication token may generate the passcode-blinding data element in an unpredictable way.
- the strong authentication token may generate the passcode-blinding data element in a way that is independent of the value of the passcode.
- the strong authentication token may generate the passcode-blinding data element using a random number generator or a pseudo-random number generator.
- the passcode-blinding data element may comprise a random number that has been generated by a random number generator or a pseudo-random number generator.
- the strong authentication token may be adapted to erase from its memory any (temporary) copy of the passcode value that the user provided once the strong authentication token has used the passcode value to calculate the value of the passcode verifier data element. Also, in some embodiments the strong authentication token may be adapted to erase from its memory any (temporary) copy of the calculated passcode verifier data element once the strong authentication token has used the calculated passcode verifier data element to generate a dynamic authentication credential.
- the dynamic variable may be a function of a time value (that may for example be provided by a clock of the strong authentication token such as a personal computing device on which a software token may be running).
- the dynamic variable may be a function of the value of an event related variable.
- event related variable may refer to a variable the value of which may be automatically updated using an update algorithm upon the occurrence of a specific event.
- the strong authentication token may, upon the occurrence of a specific event, calculate a new value for the event related variable as a function of the current value of that event related variable and may replace the current value by the calculated new value.
- the specific event may for example comprise the usage by the strong authentication token of the event related variable to generate an OTP or electronic signature.
- the event related variable may comprise a counter and the update algorithm may comprise the monotonic incrementing (or decrementing) of the counter.
- the update algorithm may comprise for example a one-way hashing algorithm and the event related variable may be updated with a new value that is obtained as the result of applying the one-way hashing algorithm to the old value of the event related variable.
- the event related variable may comprise the secret cryptographic key or a secret cryptographic key used in the generation of a dynamic credential may be derived from an event related variable.
- the value of the secret cryptographic key may be updated with a new value, that may be a function of a previous value of the secret cryptographic key, each time the secret cryptographic key is used to generate an OTP or electronic signature.
- the event related variable may comprise a state variable and the value of the secret cryptographic key may be calculated as a function of that state variable, which may be updated, upon the occurrence of a specific event, with a new value that may be a function of the current value of that state variable.
- the dynamic variable may be based on a challenge that may for example be generated by a server and that may for example be provided to the strong authentication token (e.g.
- the dynamic variable may be based on transaction data that may be provided to the strong authentication token (e.g. by the user entering the transaction data using a user input interface of the strong authentication token).
- the dynamic variable may comprise any combination of the above described types of dynamic variables.
- the result of the cryptographic combination of the value of the passcode verifier data element with the dynamic variable and the value of the secret cryptographic key may be in general referred to as a dynamic credential or a dynamic authentication credential.
- the dynamic variable is based on transaction data the result of the cryptographic combination of the value of the dynamic variable with the value of the passcode verifier data element and the value of the secret cryptographic key may be referred to as an electronic signature.
- the dynamic variable is based on a challenge the result of the cryptographic combination of the value of the dynamic variable with the value of the passcode verifier data element and the value of the secret cryptographic key may be referred to as a response.
- the dynamic variable is based on data that are internally generated and/or maintained by the strong authentication token, such as may be the case with a time value or the value of an event related variable
- the result of the cryptographic combination of the value of the dynamic variable with the value of the passcode verifier data element and the value of the secret cryptographic key may be referred to as a one-time password (OTP).
- OTP one-time password
- the cryptographic algorithm for cryptographically combining the value of the passcode verifier data element with the value of the dynamic variable and the value of the secret cryptographic key may comprise a symmetric cryptographic algorithm that may be parameterized by the secret cryptographic key, and the strong authentication token may share the secret cryptographic key with for example an authentication server.
- the symmetric cryptographic algorithm may comprise a symmetric encryption or decryption algorithm such as AES (Advanced Encryption Standard) that may operate on the value of the dynamic variable and that may be parameterized with the secret cryptographic key.
- the symmetric cryptographic algorithm may comprise a keyed hashing algorithm such as HMAC (Hash-based Message Authentication Code) that may operate on the value of the dynamic variable and that may be parameterized with the secret cryptographic key.
- a strong authentication token may take the form of a software application installed and running on a personal general purpose electronic computing device belonging to a user, such as a Personal Computer (PC), a tablet computer or a smartphone, whereby the software application may be adapted to provide authentication services for a legitimate user of the authentication software application.
- a personal general purpose electronic computing device belonging to a user such as a Personal Computer (PC), a tablet computer or a smartphone
- the software application may be adapted to provide authentication services for a legitimate user of the authentication software application.
- a strong authentication token may comprise a dedicated electronic hardware device the primary or only function of which is to provide authentication services for a legitimate user of the device.
- These authentication services may comprise generating dynamic credentials for securing interaction between a user and a computer based application such as authenticating the user to a remote computer based application and/or securing transactions submitted by the user to a remote computer based application, as is explained in more detail elsewhere in this description.
- an authentication protocol may use a sequence of cryptographic keys that are generated from a dynamic state, wherein the state is updated such that the new states can be found from old states, but not vice versa.
- the current value of the state may be maintained in a synchronized way by both the authentication client (such as a strong authentication token) and an authentication server.
- a forward-secure key-updating algorithm may be used to construct a sequence of keys and/or states.
- an authentication token may cryptographically combine a passcode, which may have been provided to the authentication token by a user of the authentication token, with such a cryptographic key to generate an authentication credential.
- the cryptographic key that is used in the generation of the authentication credential may be derived by the strong authentication token from the current value of such state which may be updated by the strong authentication token, e.g., each time after the strong authentication token has generated an authentication credential.
- the passcode is not used directly, but only to create a "passcode verifier", which is formed from the passcode and a passcode-blinding data element.
- the passcode-blinding data element may be obtained, e.g. generated, by the authentication token during an initialization stage and may be permanently stored on the authentication token, and only on the authentication token, for future use e.g., for the generation of a passcode verifier value from a passcode value.
- the passcode verifier may be generated using a one-way function such that the passcode value cannot be calculated by applying a reverse function to the resulting passcode verifier.
- the passcode-blinding data element may have a high entropy and the passcode verifier may be generated such that it also has a high entropy, such that it may be infeasible in practice to retrieve, by a brute force attack, the actual passcode value from the passcode verifier if the passcode-blinding data element is not known.
- the passcode verifier may be calculated by the authentication token by applying a hash function, preferably a cryptographically secure hash function such as SHA-256, to a combination, such as a concatenation, of the passcode value and the passcode-blinding data element.
- the passcode-blinding data element may have been generated by a true or pseudo random number generator.
- the passcode-blinding number may be generated on the basis of true or pseudo random data generated by the authentication token. In some embodiments the passcode-blinding number may be generated on the basis of true or pseudo random data generated by an authentication server. In some embodiments the passcode-blinding number may be generated on the basis of a combination of true or pseudo random data generated by the authentication token and true or pseudo random data generated by an authentication server. The actual passcode may be erased from the authentication token every time it has been used and immediately after it has been used.
- the passcode verifier may have been transferred in a secure way to a verification or authentication server and may be permanently stored on the verification or authentication server, and only on the verification or authentication token, for future use e.g., for the verification of a dynamic authentication credential generated by the authentication token.
- each generated dynamic authentication credential may be an HMAC under a key which is updated for each generated credential.
- One of the inputs to the HMAC may be the passcode verifier. After the credential has been verified the old key may be discarded and the state may be updated. In this way the verification server cannot learn the passcode (it only has a copy of the passcode verifier, and not the passcode data element so that the actual passcode value cannot be retrieved from applying a brute force attack on the copy of the passcode verifier held at the server).
- the authentication token never stores the passcode, so extracting information from the authentication token won't allow the passcode to be discovered (although the passcode-blinding data element is stored on the authentication token, it can't be used to retrieve the value of the passcode by a brute force attack without knowledge of the passcode verifier).
- Protocol, system and method of the invention may be related to how to keep the server and client in sync, which may be by following certain rules as to when to update the state. More details of these aspects are described elsewhere in this description.
- the techniques described in this description may also apply to any sensitive user authentication related data which should remain secret and may be vulnerable to brute force attacks e.g. because they may have a low entropy.
- these techniques may also be applied to PINs, passwords and biometric templates, which could all be examples of a passcode.
- ciphertext ENC(K, IV, Data)" denotes encrypting the bit string 'Data' to obtain the result 'ciphertext' using a cryptographic encryption algorithm parameterized with the cryptographic encryption key 'K' using (if applicable for the chosen encryption algorithm) the initialization vector 'IV'.
- the encryption algorithm may comprise a symmetric encryption algorithm.
- the symmetric encryption algorithm may comprise a block cipher such as AES (Advanced Encryption Standard) or 3DES (Triple Data Encryption Standard) in some encryption mode.
- the AES algorithm may be used in the CTR-mode (Counter mode, see also: the website located at web address en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CTR) and the key K may have a size of 128-bit and the starting value of the counter for the CTR-mode may be calculated from the initialization vector.
- the starting value of the counter for the CTR-mode may be calculated as the initialization vector left shifted over a number of positions, e.g. IV ⁇ 64.
- the initialization vector may be calculated from a counter 'CTR' and a random number.
- a credential may be calculated using a key 'K' and an input bit string 'Data' using a cryptographic function using as inputs the key 'K' and the bit string 'Data'.
- the credential may be calculated as a message authentication code (MAC) using as inputs the key 'K' and the bit string 'Data'.
- the cryptographic function for calculating the credential may comprise a encryption (or decryption) of the bit string 'Data' under the key 'K'.
- the cryptographic function for calculating the credential may comprise a one-way function.
- the one-way function may comprise a cryptographic hash function.
- the one-way function may comprise a keyed hash function.
- the key K may have a size of 128 bits.
- the resulting cryptogram, hash or MAC may be truncated. In some embodiments, if Data is not a multiple of 8 bits, then it may be left zero-padded to the next byte-boundary.
- state i+1 , key i+1 UPDATE(state i )" denotes updating the values of a key and a state by using some cryptographic key and state updating algorithm to calculate the new values 'key i+1 ' for the key and 'state i+1 ' for the state starting from the old value 'state i ' of the state, and replacing (if applicable) the old values for the key and the state by the newly calculated values.
- the new value of the state may be calculated from the current value of the state using a first irreversible function that takes the current value of the state as an input.
- the new value of the cryptographic key may be calculated from the current value of the state using a second irreversible function that takes the current value of the state as an input.
- the irreversible functions for calculating the new values of the state and the cryptographic key from the current value of the state may comprise for example a secure cryptographic hash function.
- the cryptographic key and state updating algorithm may comprise a key updating algorithm such as the key updating algorithm disclosed in "Forward-Security in Private-Key Cryptography" by Mihir Bellare and Bennet Yee, Springer LNCS 2612.
- the cryptographic key and state updating algorithm may be defined as:
- a number of constants may be used.
- the following constants may be used: VERSION, MSG_CHALLENGE, MSG_RESPONSE, MSG_ACTIVATION_CHALLENGE, MSG_ACTIVATION_RESPONSE, wherein the latter four constants may have values that are all different from each other. In a particular embodiment these constants may have the following values:
- All parameters are for a particular authentication token - server combination.
- the data retrieved by the server for a particular authentication token may correspond to a particular user account that is being or has been logged in to.
- the data retrieved by the server may correspond to the particular authentication token or the particular instance of the authentication application launched.
- the attacker may control a network for passing messages between the authentication token and the server, and may be capable of mounting a full MitM (Man-in-the-Middle) attack.
- MitM Man-in-the-Middle
- the authentication token or application is secure.
- the server is secure.
- the authentication token may be implemented using secure hardware, and the authentication token may be able to MAC and/or decrypt arbitrary messages but may not release keys. In such embodiments it may be advantageous if a nonce is included in messages. An attacker with only temporary access to the authentication token cannot predict nonces for any future transactions.
- the initial state of an authentication token or application may be as shown above. Before transaction signing or dynamic credential generation can be performed, it may be necessary to activate the authentication token or application. In some embodiments activation may be performed only once, but it may be closely related to passcode changing. The end result of the activation may be that on the one hand the server may have a copy of the passcode verifier (PV), and on the other hand the client may have stored a corresponding value of the passcode-blinding data element (PR). This step may be performed so that the server does not get to know the user's passcode, but can verify whether it was entered correctly for the generation of a credential that may have been received by the server.
- PV passcode verifier
- PR passcode-blinding data element
- the response message from the client which may comprise the value of the passcode verifier, may be encrypted under a forward secure key so that if someone steals the authentication token, which may for example comprise a smartphone, and has observed a credential generated by the authentication token, they cannot guess the user's passcode.
- the user may contact the server, and may initiate the activation procedure.
- the activation procedure or activation protocol may comprise the following steps:
- This authentication sub-protocol may be performed to allow users to authenticate themselves or to authorize a particular transaction.
- the result may for example be that the server, upon successful verification of the authentication credential provided by the user, concludes that the user has seen the correct transaction details and has entered the correct passcode.
- the server should not know the passcode itself. An eavesdropper who records all communication should not be able to get the passcode, even after stealing the phone (since the MAC key is discarded after use).
- Step 1 In some embodiments the user may contact the server and may initiate an authentication or transaction.
- Step 2 The client may obtain the value of a dynamic variable.
- the value of the dynamic variable may be based on a counter maintained by the client.
- the client may synchronize its value of such a counter with the corresponding counter value maintained by the server.
- the value of the dynamic variable may be based on an external data element that the client may receive for example in a message from the server.
- the external data element may for example comprise a challenge and/or nonce which may be generated by the server.
- the external data element may for example also comprise transaction data representing a transaction to be authorized by the user.
- the server may authenticate the message, e.g., by adding a message authentication code (MAC).
- MAC message authentication code
- the server may also encrypt the server message.
- the server may generate and send a challenge message to the client as follows: S -> C: ⁇ Version, Service ID, User ID, IV, ENC(KSENC, IV, ⁇ Transaction, Type, Nonce, Challenge_MAC ⁇ ) ⁇ where:
- Step 4 The server may generate an expected response (which in some embodiments may be truncated to 30 bits), which may serve as a credential reference value to be compared with a authentication credential that the server may subsequently receive from the client:
- S: E HMAC(K, ⁇ Version, Type, Transaction, Nonce, IV, PV ⁇ ) where:
- Step 5 Client may decode the received challenge message
- Step 7 Client may decrypt the received challenge message and verify the Challenge_MAC to authenticate the source of the message. If this verification fails, then the client may abort.
- Step 9a The client may present to the user the transaction data encoded in Transaction and prompt the user to authorize the presented transaction data. If Transaction doesn't contain meaningful data (such as a hardcoded value, or a hash value) then this step may be skipped. If the user doesn't authorize the presented transaction data, the client may abort.
- Transaction doesn't contain meaningful data (such as a hardcoded value, or a hash value) then this step may be skipped. If the user doesn't authorize the presented transaction data, the client may abort.
- Step 9b The client may prompt the user to provide the passcode. If the user doesn't provide the passcode, the client may abort. In some embodiments the user may implicitly indicate authorization (e.g. of the presented transaction data) by providing the passcode.
- Step 10 the key K and the state SCRES may be updated on client (in order to synchronize the state of the client with the state of the server, this may be repeated a number of times based on the counter):
- C: SCRES, K: UPDATE(SCRES);
- Step 11 The client may generate an authentication credential in response to receiving the challenge message from the server and the client may return the generated authentication credential to the server as follows:
- Step 12 the server may verify whether the authentication credential matches the expected response E.
- the server may generate a signal indicating whether the verification of the authentication credential was successful.
- the User ID and/or the Service ID may be included into the MAC for completeness.
- the message type may be moved to the start of the message, so that it can be used to decide how the remainder of the message should be decoded.
- the passcode may comprise secret information provided by a user, such as for example a PIN or a password.
- the passcode may comprise other information that may be related to the user or that may be specific to the user and that may have a sensitive nature and should remain confidential, such as for example some kinds of biometric information.
- Figure 1 schematically illustrates an exemplary apparatus or token (100) of the invention according to an aspect of the invention.
- the apparatus or token ( 100 ) may comprise a strong authentication token.
- the apparatus or token may for example comprise a dedicated electronic hardware device the primary or only function of which is to provide authentication services for a legitimate user of the device.
- the apparatus or token ( 100 ) may comprise a personal general computing device such as a PC (Personal Computer), a tablet computer, a smartphone, or a smart watch.
- the apparatus or token ( 100 ) may comprise any of the strong authentication tokens or authentication clients described in more detail elsewhere in this description.
- the apparatus or token ( 100 ) may be adapted to perform any of the method steps or actions performed by any of the strong authentication tokens or authentication clients described in more detail elsewhere in this description.
- the apparatus or token ( 100 ) may comprise a human user input interface ( 120 ), a human user output interface ( 130 ), a data input interface ( 140 ), a data processor ( 150 ), a memory component ( 160 ), and a component ( 170 ) for providing the value of a dynamic variable.
- the token may comprise a digital data processing component ( 150 ) that may be adapted to execute a set of data processing instructions, e.g., to implement one or more of the functions attributed to any of the strong authentication tokens or authentication clients described in more detail elsewhere in this description.
- the data processing component ( 150 ) may comprise for example one or more microprocessors, microcontrollers, Digital Signal Processor (DSP) chips, Field Programmable Gate Arrays (FPGA), Application Specific Integrated Circuit ASIC), etcetera.
- the token may comprise a memory component ( 160 ).
- the memory component ( 160 ) may be connected to the digital data processing component ( 150 ).
- the memory component may comprise a program memory component that is adapted to store software or firmware to be executed by the data processing component.
- the functionality that the token supports may be defined by the software or firmware stored in its memory.
- the memory component ( 160 ) may comprise a data memory component that is adapted to permanently or temporarily store data.
- the data memory component may be adapted to securely store secret data such as cryptographic keys or a passcode-blinding data element.
- the data memory component may be adapted to store the data of multiple token instances.
- the memory component may for example comprise RAM (Random Access Memory) memory, ROM (Read-Only Memory) memory, EPROM (Erasable Programmable Read-Only Memory) memory, one-time programmable memory, flash memory, solid-state memory, a hard-disk, etc.
- RAM Random Access Memory
- ROM Read-Only Memory
- EPROM Erasable Programmable Read-Only Memory
- flash memory solid-state memory
- hard-disk etc.
- the token may furthermore comprise a random or pseudo-random number generator that the token may use for example to generate a passcode-blinding data element.
- the strong authentication token may comprise a user interface ( 120, 130 ) to interact with a user e.g. to exchange data, information and/or commands with a user.
- the user interface ( 120, 130 ) may be connected to the digital data processing component ( 150 ).
- the strong authentication token's user interface may comprise an output user interface ( 130 ) for presenting information and/or data (such as instructions or messages for the user, transaction data to be approved by the user, a dynamic credential generated by the strong authentication token) to a user of the strong authentication token.
- the output user interface may comprise for example a display ( 130 ) or an audio output interface.
- the strong authentication token's user interface may comprise an input user interface ( 120 ) for receiving inputs from a user such as for example input data (like a challenge or transaction data) or instructions (like a confirmation, authorization or cancellation) or a passcode.
- the input user interface may comprise for example a keyboard ( 120 ).
- the strong authentication token's user interface may comprise a touch screen which may be adapted to offer both the functions of a user output interface and a user input interface.
- the strong authentication token may comprise a digital data input interface.
- the data input interface ( 140 ) may be connected to the digital data processing component ( 150 ).
- the strong authentication token's digital data input interface may be adapted to receive digital data messages.
- the digital data input interface may for example comprise an internet connection.
- the digital data input interface may for example comprise a local wired data connection such as a Universal Serial Bus (USB) connection.
- the digital data input interface may comprise a local wireless data interface such as for example a BLUETOOTH or Wi-Fi interface.
- the digital data input interface may comprise a mobile data communication network interface.
- the strong authentication token may for example comprise a smartphone.
- the data input interface may comprise an optical image acquiring component ( 140 ).
- the optical image acquiring component may comprise a camera.
- the strong authentication token may be adapted to capture with the optical image acquiring component images that may be encoded with a digital data message.
- the image may comprise a two-dimensional barcode.
- the format of the image may be defined in a standard.
- the optical image may be a QR-code.
- the digital data input interface may comprise an acoustical interface adapted to capture acoustical signals that may be encoded with messages or commands for the token.
- the acoustical interface may comprise a microphone.
- the acoustical interface may comprise an analogue-to-digital convertor to convert the analogue electronic signal into a digital signal that may be further processed by for example the digital data processing component discussed above.
- the apparatus or token ( 100 ) may be adapted to use the data input interface ( 140 ) to receive any of the authentication messages, described in more detail elsewhere in this description, that may have been generated by an authentication server and sent to the apparatus or token, for example in the form of a two-dimensional barcode which, for example, may be displayed by an access device as explained in more detail elsewhere in this description.
- the token may be adapted to generate dynamic credentials as explained in more detail elsewhere in this description.
- the data processing component ( 150 ) may be adapted to perform cryptographic calculations to generate the dynamic credentials.
- the token may be adapted to generate dynamic credentials using cryptographic keys that may be stored permanently or temporarily in the memory component ( 160 ) or that the token may derive from data stored permanently or temporarily in the memory component ( 160 ).
- the token may be adapted to generate dynamic credentials using data that is part of a token instance stored in the memory component ( 160 ).
- the token may be adapted to use a symmetric cryptographic algorithm to generate the dynamic credentials.
- this cryptographic algorithm for generating dynamic credentials may be parameterized with one or more symmetric secret cryptographic credential generation keys.
- the credential generation keys may be shared with a server such as for example a credential verification server or an authentication server.
- the token may be adapted to generate dynamic credentials using a dynamic variable that may comprise an internal value provided by the token.
- the token may comprise a clock ( 170 ) and the token may use as an internal value the time value provided by that clock.
- the token may maintain a counter and the token may be adapted to use the value of that counter as in internal value to generate a dynamic credential for that instance and update the value of that counter (e.g. by incrementing or decrementing) each time the token uses the value of that counter to generate a dynamic credential.
- the token may be adapted to generate dynamic credentials using a dynamic variable that may comprise an external value provided to the token.
- an external value may comprise a challenge or nonce generated by a server or transaction data to be signed.
- the external value may be manually provided to the token by the user by using the user input interface of the token.
- the token may capture a challenge or transaction data the user may enter as a string of characters on a keyboard comprised in the token.
- the external value is provided comprised in a message or command that is received by the token by means of its data input interface.
- the token may be adapted to present the generated dynamic credential to the user.
- the token may display the generated dynamic credential as a string of readable characters on its display.
- the string may comprise only decimal characters.
- the string may comprise alphanumerical characters.
- the token (100) may be a dedicated hardware device.
- the token may be dedicated to be used in methods to secure a user's access to an application (which may be a computer based or automated application) or to secure a user's interaction with such an application.
- the main goal of the authentication device is to be used in methods to secure a user's access to an application or to secure a user's interaction with such an application.
- the authentication device in order to guarantee the authentication device's dedication to its use as a security device, the authentication device may be adapted to make it impossible to alter its firmware.
- any change to or update of its firmware is only possible through a secure firmware update protocol that is designed to ensure that only an authorised controlling trusted party can update or change the firmware of the authentication device.
- This enables the controlling trusted party to ensure that no firmware update happens which would undo or compromise the authentication device's dedication to its use in methods to secure a user's access to an application or to secure a user's interaction with such an application.
- Devices where the users can install extra software that is not authorized by a controlling trusted party cannot be considered dedicated devices.
- Devices the main purpose of which is to offer telecommunication facilities cannot be considered devices dedicated to be used in methods to secure a user's access to and interaction with an application.
- General purpose PCs, laptops, tablet computers and smartphones cannot be considered dedicated devices.
- the token ( 100 ) is a secure hardware device.
- the secure hardware device is adapted to ensure detection of and/or resist to attempts to tamper with the secure hardware device.
- the housing of the secure hardware device is adapted to resist to opening the housing and/or to increase the probability that a user will notice attempts to open the housing through deformation of the housing (tamper evidence).
- parts that together make up the housing may be welded or glued together so that attempts to detach these parts will typically lead to obvious deformation of the housing.
- the secure hardware device comprises a switch that detects opening of the housing.
- the secure hardware device is adapted to take appropriate action upon detecting an attempt to tamper.
- the secure hardware device may erase certain sensitive data such as cryptographic keys, a passcode-blinding data element, or the secure hardware device may (possibly irreversibly) go into an error mode or cease to function upon detecting a presumed attempt to tamper with the secure hardware device.
- the secure hardware device may have a secure user output interface (e.g. a secure display) and a secure user input interface (e.g. a secure keyboard).
- a secure user output interface e.g. a secure display
- a secure user input interface e.g. a secure keyboard
- the secure hardware device has an output interface that is secure in that it is fully controlled by the secure hardware device and that it cannot be used to present data or information to a user by a process external to the secure hardware device or that it can only be used to present data or information to a user by a process external to the secure hardware device if that is authorized and controlled by the secure hardware device.
- the secure hardware device has a user input interface that is secure in that it is fully controlled by the secure hardware device and that it cannot be used to obtain data or information from a user by a process external to the secure hardware device or that it can only be used to obtain data or information from a user by a process external to the secure hardware device if that is authorized and controlled by the secure hardware device.
- the security of the secure user input and output interfaces is maintained by the secure hardware device not allowing any change to its firmware or providing a secure firmware update mechanism that only allows changes to its firmware through a secure protocol that ensures that the secure hardware device accepts only authorised firmware updates from a trusted source.
- the token is not a dedicate hardware device.
- the token may comprise an electronic consumer device the primary purpose of which may not be to provide authentication functionality but which may comprise software for providing the strong authentication token functionality described in this description.
- the token may comprise a tablet computer or a smartphone comprising an authentication app providing the strong authentication token functionality described in this description.
- the token may comprise a plastic circuit board (PCB) on which at least some of the electronic components comprised in the token may be arranged. Other electronic components may be galvanically connected to components arranged on the circuit board (e.g. by electrical wires). In some embodiments all electronic components of the token are comprised within a single housing. In some embodiments the housing may be made of plastic or of metal or of a combination of materials.
- the authentication token may be a monolithic device. In the context of this description this means that the digital data processing component for generating the dynamic credentials, the memory component for storing instance data, the input user interface, the output user interface and the data input interface comprised in the authentication token are all comprised into a single physical device. In some embodiments these components cannot be removed by the user as part of the ordinary operation of the authentication token. In some embodiments these components cannot be removed without causing irreversible change to the authentication token. In some embodiments these components cannot be removed without permanent damage to the authentication token.
- PCB plastic circuit board
- the token may comprise more than one electronic device whereby the various functionalities of the token may be taken care of by the different devices.
- the token may comprise a secure element such as a smart card and a reader device, whereby the secure element may take care of storing security sensitive data elements such as secret key related data and/or a passcode-blinding data element.
- the secure element may further be adapted to take care of some or all of the cryptographic calculations for the generation of a dynamic authentication credential.
- the reader may for example comprise a user input interface and a user output interface, and a data input interface.
- the secure element may comprise a data communication interface to communicate with the reader, and the reader may comprise a complementary data communication interface to communicate with the secure element.
- the secure element and the reader may be adapted to cooperate and to provide together all the functionalities of the token described elsewhere in this description.
- the token has a weight and spatial measures such that the token can be considered to be a portable, pocket-sized, hand-held device.
- the reader has a weight and spatial measures such that the token can be sent to the user through mail at moderate costs.
- the authentication device may have a thickness of less than 2 cm, a width of less than 10 cm, a length of less than 15 cm, and a weight of less than 200 grams. In other embodiments the authentication device may have a thickness of less than 1.5 cm, a width of less than 7 cm, a length of less than 13 cm, and a weight of less than 110 grams.
- the length and width of the authentication device may exceed the length respectively the width of a standard full size credit card by no more than 10 per cent. In some embodiments the authentication device may have the length and width of a standard full size credit card. In some embodiments the authentication device may have the length, width and thickness of a standard full size credit card within the margins applicable for standard full size credit cards (e.g. having the dimensions of an ID-1 sized smart card as specified by ISO/IEC 7810).
- the authentication device comprises an autonomous source of electrical power.
- the power source may comprise a battery.
- the battery may be replaceable.
- Figure 2 schematically illustrates an exemplary system ( 200 ) of the invention according to an aspect of the invention.
- the system may comprise a strong authentication token ( 220 ), and an authentication server ( 230 ) .
- the system may further comprise an application server ( 250 ) .
- the system may further comprise an access device ( 260 ) .
- the system may further comprise a computer network ( 270 ) .
- the strong authentication token ( 220 ) may comprise any of the strong authentication tokens or authentication clients described in more detail elsewhere in this description.
- the strong authentication token ( 220 ) may comprise the apparatus ( 100 ) described in connection to figure 1 .
- the authentication server ( 230 ) may comprise any of the authentication servers or credential verification servers or entities described in more detail elsewhere in this description. In some embodiments the authentication server ( 230 ) may be adapted to perform any of the method steps or actions performed by any of the authentication servers or credential verification servers or entities described in more detail elsewhere in this description.
- the authentication server ( 230 ) may comprise one or more computing devices such as server computers. In some embodiments the authentication server may be adapted to perform cryptographic calculations. In some embodiments the authentication server may be adapted to verify the validity of a dynamic authentication credential generated by a client or token. In some embodiments the authentication server has access to user and/or token specific information.
- Such user and/or token specific information may include for example a user identification data element (user id), secret data such as a passcode verifier, key related data to generate or obtain the value of a cryptographic key that the token (presumably) has used to generate the dynamic authentication credential.
- the token may generate the cryptographic key as a function of the value of a state variable maintained by the token and the authentication server may have access to a state variable representing the value of the state variable of the token.
- the authentication server may store these data elements in a database which may be comprised in or connected to the authentication server.
- the application server ( 250 ) may be adapted to host the server part of a remotely accessible computer based application.
- the interaction between a user and the remotely accessible computer based application may be secured using the authentication token ( 220 ) and the authentication server ( 230 ) with any of the authentication methods described in more detail elsewhere in this description.
- the application server ( 250 ) may comprise a web server and the remotely accessible computer based application may be a web based application such as for example a web banking or internet banking application.
- the access device ( 260 ) may be adapted to allow a user ( 290 ) to access and interact with the remotely accessible computer based application hosted by the application server ( 250 ).
- the access device ( 260 ) may for example comprise a web browser to interact with the remotely accessible computer based application hosted by the application server ( 250 ).
- the access device ( 260 ) may for example comprise a PC, or tablet computer or a smartphone,
- the computer network ( 270 ) may comprise a LAN (Local Area Network), and/or a WAN (Wide Area Network), and/or the Internet, and/or a wireless data telecommunication network such as for example a mobile phone network.
- the computer network ( 270 ) may link two or more computing devices such as the strong authentication token ( 220 ), the authentication server ( 230 ), the application server ( 250 ) and the access device ( 260 ), and it may be adapted to enable these computing devices to communicate with each other and to exchange data and messages such as for example any of the various messages exchanged by any of the authentication clients or authentication tokens and any of the authentication servers described in more detail elsewhere in this description.
- Figure 3 schematically illustrates an exemplary method ( 300 ) for generating a dynamic credential.
- the method for generating a dynamic credential comprises the following steps: obtaining ( 310 ) from a user a passcode value, retrieving ( 320 ) a stored value of a passcode-blinding data element, calculating ( 330 ) a passcode verifier by cryptographically combining the obtained passcode value and the retrieved value of the passcode-blinding data element, calculating ( 340 ) a dynamic credential by cryptographically combining the calculated passcode verifier with a stored secret key and a dynamic variable.
- the secret key may comprise the dynamic variable.
- the method may further comprise updating the value of the secret key with a new value.
- the method may comprise: updating a state variable by calculating a new value for the state variable based on the old value of the state variable, erasing the old value of the state variable, erasing the old variable of the key, calculating a new variable for the secret key based on the new value of the state variable.
- a method for generating a dynamic authentication credential is provided.
- some or all steps of the method may be performed by any of the authentication clients or authentication tokens described elsewhere in this description.
- the method may comprise some or all of the methods of any of the methods for generating a dynamic authentication credential that are described elsewhere in this description.
- the method may comprise some or all of the steps of the methods described in connection to figure 3 .
- the method ( 300 ) may comprise the steps of: obtaining ( 310 ) the value of a passcode, obtaining ( 320 ) the value of a passcode-blinding data element, obtaining the value of a dynamic variable, obtaining the value of a cryptographic credential generation key, calculating ( 330 ) the value of a passcode verifier data element from the obtained passcode value and the obtained passcode-blinding data element value, calculating ( 340 ) the dynamic authentication credential from the calculated passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value.
- obtaining the value of the passcode may comprise receiving the value of the passcode from a user, e.g., as input provided by the user through a user input interface of an authentication token or authentication client device.
- the passcode value may comprise a PIN (Personal Identification Number) value or a password value.
- obtaining the value of the passcode-blinding data element may comprise reading the passcode-blinding data element value from a memory of for example an authentication token or authentication client performing the method.
- the passcode-blinding data element may have been generated and stored, e.g. in the memory of an authentication token or authentication client performing the method, for example as part of an initialization phase of such an authentication token or authentication client, prior to generating dynamic authentication credentials.
- the passcode-blinding data element value may be generated as a high entropy data element.
- the entropy of the passcode-blinding data element may be at least 64 bits; in other embodiments the entropy may be at least 128 bits; in still other embodiments the entropy may be at least 256 bits.
- the passcode-blinding data element value may be generated using a random or pseudo-random number that may be generated by a random or pseudo-random number generator.
- obtaining the dynamic variable value may comprise receiving a message from for example a server, such as an authentication server, and determining the dynamic variable value as a function of a data element, such as a challenge or nonce or transaction data, that is comprised in the received message.
- obtaining the dynamic variable value may comprise determining the dynamic variable as a function of transaction data and presenting the transaction data to a user for approval and obtaining the user's approval.
- calculating the passcode verifier data element value may comprise calculating the passcode verifier data element value as a cryptographic function of the obtained passcode value and the obtained passcode-blinding data element value. In some embodiments calculating the passcode verifier data element value may comprise calculating the passcode verifier data element value as the result of applying an irreversible (cryptographic) function to the obtained passcode value and the obtained passcode-blinding data element value. In some embodiments applying the irreversible function may comprise applying a (secure) cryptographic hash function to a combination of the obtained passcode value and the obtained passcode-blinding data element value.
- the (secure) cryptographic hash function may comprise one of the SHA-2 or SHA-3 (Secure Hash Algorithm) family of functions.
- applying the irreversible function may comprise applying a secure cryptographic keyed-hash function to the obtained passcode value using the obtained passcode-blinding data element value as a key for the keyed-hash function.
- the keyed-hash function may comprise the HMAC (Hash-based Message Authentication Code or keyed-hash message authentication code) function.
- applying the irreversible function may comprise applying a secure cryptographic encryption (or decryption) function to the obtained passcode value using the obtained passcode-blinding data element value as an encryption (or decryption) key.
- the encryption function may comprise the AES (Advanced Encryption Standard) encryption algorithm.
- calculating the dynamic authentication credential from the calculated passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value may comprise calculating the dynamic authentication credential as a cryptographic function of the calculated passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value. In some embodiments calculating the dynamic authentication credential from the calculated passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value may comprise calculating the dynamic authentication credential as the result of applying an irreversible (cryptographic) function to the calculated passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value.
- applying the irreversible function may comprise applying a (secure) cryptographic hash function to a combination of the calculated passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value.
- the (secure) cryptographic hash function may comprise one of the SHA-2 or SHA-3 (Secure Hash Algorithm) family of functions.
- applying the irreversible function may comprise applying a secure cryptographic keyed-hash function to a combination of the calculated passcode verifier data element value and the obtained dynamic variable value using the obtained cryptographic credential generation key value as a key for the keyed-hash function.
- the keyed-hash function may comprise the HMAC (Hash-based Message Authentication Code or keyed-hash message authentication code) function.
- applying the irreversible function may comprise applying a (secure) cryptographic encryption (or decryption) function to a combination of the calculated passcode verifier data element value and the obtained dynamic variable value using the obtained cryptographic credential generation key value as an encryption (or decryption) key.
- the encryption function may comprise the AES (Advanced Encryption Standard) encryption algorithm.
- the method may further comprise the step of discarding the obtained passcode value after the step of calculating the passcode verifier data element value.
- discarding the obtained passcode value may comprise erasing all copies of the obtained passcode value from a memory of for example an authentication token or authentication client performing the method.
- the method may further comprise the step of discarding the calculated passcode verifier data element value after the step of calculating the dynamic authentication credential.
- discarding the calculated passcode verifier data element value may comprise erasing all copies of the calculated passcode verifier data element value from a memory of for example an authentication token or authentication client performing the method.
- obtaining the cryptographic credential generation key value may comprise determining the cryptographic credential generation key value as a function of the value of a state variable. In some embodiments the method may further comprise maintaining and storing in memory the value of the state variable. In some embodiments determining the cryptographic credential generation key value as a function of the value of a state variable may comprise reading the state variable value from a memory of for example an authentication token or authentication client performing the method. In some embodiments determining the cryptographic credential generation key value as a function of the value of a state variable may comprise setting the cryptographic credential generation key value to the value of the state variable.
- determining the cryptographic credential generation key value as a function of the value of the state variable may comprise calculating the cryptographic credential generation key value as the result of applying an irreversible function to the value of the state variable.
- the irreversible function may comprise a (secure) cryptographic hash function which may comprise one of the SHA-2 or SHA-3 (Secure Hash Algorithm) family of functions.
- applying the irreversible function may comprise applying a (secure) cryptographic encryption (or decryption) function to a fixed value using the value of the state variable as an encryption (or decryption) key.
- the encryption function may comprise the AES (Advanced Encryption Standard) encryption algorithm.
- the method may further comprise updating the value of the state variable with a new value that is calculated as a function of the present value of the state variable (wherein the present value has become the previous value after the update).
- calculating the new value of the state variable as a function of the present (previous) value of the state variable may comprise calculating the new value of the state variable as the result of applying an irreversible function to the present (previous) value of the state variable.
- the irreversible function may comprise a (secure) cryptographic hash function which may comprise one of the SHA-2 or SHA-3 (Secure Hash Algorithm) family of functions.
- applying the irreversible function may comprise applying a (secure) cryptographic encryption (or decryption) function to a fixed value using the present (previous) value of the state variable as an encryption (or decryption) key.
- the encryption function may comprise the AES (Advanced Encryption Standard) encryption algorithm.
- the method may further comprise discarding the present (previous) value of the state variable after said calculating of the new value of the state variable as a function of the present value of the state variable.
- the step of discarding the present (previous) value of the state variable may be performed after both the calculating of the new value of the state variable and the determining the cryptographic credential generation key value as a function of the present (previous) value of a state variable have been performed.
- discarding the present (previous) value of the state variable may comprise erasing all copies of the present (previous) value of the state variable from a memory of for example an authentication token or authentication client performing the method.
- the method may further comprise discarding the cryptographic credential generation key value after said calculating the dynamic authentication credential. In some embodiments discarding the cryptographic credential generation key value may comprise erasing all copies of the cryptographic credential generation key value from a memory of for example an authentication token or authentication client performing the method. In some embodiments the method may further comprise discarding, after said calculating the dynamic authentication credential, the value of the state variable from which the cryptographic credential generation key value has been derived. In some embodiments discarding the value of the state variable may comprise erasing all copies of the value of the state variable from a memory of for example an authentication token or authentication client performing the method.
- a method for verifying a value of a dynamic authentication credential is provided.
- some or all steps of the method may be performed by any of the authentication servers described elsewhere in this description.
- the method may comprise some or all of the steps of any of the methods for verifying a value of a dynamic authentication credential described elsewhere in this description.
- the value of the dynamic authentication credential may have been generated by any of the methods for generating a dynamic authentication credential that are described in this description.
- FIG. 4 An exemplary embodiment of the method is illustrated in figure 4 .
- the method ( 400 ) may comprise the steps of: receiving ( 410 ) the dynamic authentication credential value; obtaining ( 420 ) the value of a dynamic variable; obtaining ( 430 ) the values of a passcode verifier data element and a cryptographic credential generation key; calculating ( 440 ) a credential reference value from the obtained passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value; and verifying ( 450 ) whether the received dynamic authentication credential value matches the calculated credential reference value.
- the method may further comprise the step of generating a signal indicating whether the received dynamic authentication credential value matches the calculated credential reference value.
- the dynamic variable may comprise or may be derived from transaction data representative of a transaction to be authorized by the dynamic authentication credential.
- calculating ( 440 ) the credential reference value from the obtained passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value may comprise calculating the credential reference value as a cryptographic function of the obtained passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value. In some embodiments calculating the credential reference value from the obtained passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value may comprise calculating the credential reference value as the result of applying an irreversible (cryptographic) function to the obtained passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value.
- applying the irreversible function may comprise applying a (secure) cryptographic hash function to a combination of the obtained passcode verifier data element value, the obtained dynamic variable value and the obtained cryptographic credential generation key value.
- the (secure) cryptographic hash function may comprise one of the SHA-2 or SHA-3 (Secure Hash Algorithm) family of functions.
- applying the irreversible function may comprise applying a secure cryptographic keyed-hash function to a combination of the obtained passcode verifier data element value and the obtained dynamic variable value using the obtained cryptographic credential generation key value as a key for the keyed-hash function.
- the keyed-hash function may comprise the HMAC (Hash-based Message Authentication Code or keyed-hash message authentication code) function.
- applying the irreversible function may comprise applying a (secure) cryptographic encryption (or decryption) function to a combination of the obtained passcode verifier data element value and the obtained dynamic variable value using the obtained cryptographic credential generation key value as an encryption (or decryption) key.
- the encryption function may comprise the AES (Advanced Encryption Standard) encryption algorithm.
- verifying whether a first value matches a second value may comprise or may consist of verifying whether the first value is equal to the second value. In some embodiments verifying whether a first value matches a second value may comprise or may consist of verifying whether a first function of the first value is equal to a second function of the second value. For example, in some embodiments verifying whether a first value matches a second value may comprise or may consist of verifying whether a first bit string representation of the first value is equal to a truncated version of a second bit string representation of the second value. In some embodiments verifying whether a first value matches a second value may comprise or may consist of verifying whether a mathematical relation between the first value and the second value is true.
- obtaining the values of a passcode verifier data element and a cryptographic credential generation key may comprise obtaining a set of user or authentication client specific data associated with a particular user of authentication client and retrieving or deriving the values of the passcode verifier data element and the cryptographic credential generation key from this set of user or authentication client specific data.
- the set of user or authentication client specific data is associated with a user of authentication client from which the received dynamic authentication credential value is presumed to have been received.
- the method may further comprise storing and maintaining the set of user or authentication client specific data in a memory or database which may be comprised in or connected to for example an authentication server performing the steps of the method, and obtaining the set of user or authentication client specific data may comprise reading the set of user or authentication client specific data from this memory or database.
- the set of user or authentication client specific data may comprise a value of a state variable and obtaining the cryptographic credential generation key value may comprise determining the cryptographic credential generation key value as a function of the value of the state variable that is comprised in the set of user or authentication client specific data. In some embodiments determining the cryptographic credential generation key value as a function of the value of the state variable may comprise setting the cryptographic credential generation key value to the value of the state variable. In other embodiments determining the cryptographic credential generation key value as a function of the value of the state variable may comprise calculating the cryptographic credential generation key value as the result of applying an irreversible function to the value of the state variable.
- the irreversible function may comprise a (secure) cryptographic hash function which may comprise one of the SHA-2 or SHA-3 (Secure Hash Algorithm) family of functions.
- applying the irreversible function may comprise applying a (secure) cryptographic encryption (or decryption) function to a fixed value using the value of the state variable as an encryption (or decryption) key.
- the encryption function may comprise the AES (Advanced Encryption Standard) encryption algorithm.
- the method may further comprise the step of updating the value of the state variable with a new value that is calculated as a function of the value of the state variable that is comprised in the set of user or authentication client specific data and replacing the value of the state variable that is comprised in the set of user or authentication client specific data with this calculated new value.
- the method may further comprise the step of storing the set of user or authentication client specific data comprising the updated value of the state variable in a memory or database which may be comprised in or connected to for example an authentication server performing the steps of the method.
- calculating the new value of the state variable as a function of the value of the state variable that is comprised in the set of user or authentication client specific data may comprise calculating the new value of the state variable as the result of applying an irreversible function to the value of the state variable that is comprised in the set of user or authentication client specific data.
- the irreversible function may comprise a (secure) cryptographic hash function which may comprise one of the SHA-2 or SHA-3 (Secure Hash Algorithm) family of functions.
- applying the irreversible function may comprise applying a (secure) cryptographic encryption (or decryption) function to a fixed value using the value of the state variable that is comprised in the set of user or authentication client specific data as an encryption (or decryption) key.
- the encryption function may comprise the AES (Advanced Encryption Standard) encryption algorithm.
- the method may further comprise discarding the value of the state variable that is comprised in the set of user or authentication client specific data after said calculating of the new value of the state variable as a function of the value of the state variable that is comprised in the set of user or authentication client specific data.
- discarding the value of the state variable that is comprised in the set of user or authentication client specific data may comprise erasing all copies of the value of the state variable that is comprised in the set of user or authentication client specific data from a memory or database which may be comprised in or connected to for example an authentication server performing the steps of the method.
- the method may further comprise the step of discarding the cryptographic credential generation key value after the step of calculating the credential reference value.
- discarding the cryptographic credential generation key value may comprise erasing all copies of the cryptographic credential generation key value from a memory or database which may be comprised in or connected to for example an authentication server performing the steps of the method.
- the method may further comprise the step of discarding, after the step of calculating the credential reference value, the value of the state variable from which the cryptographic credential generation key value has been derived.
- discarding the value of the state variable from which the cryptographic credential generation key value has been derived may comprise erasing all copies of this value of the state variable from a memory or database which may be comprised in or connected to for example an authentication server performing the steps of the method.
- a method for securing a user's interaction with a computer-based application may comprise performing by an authentication token or authentication client some or all steps of any of the methods for generating a dynamic authentication credential described elsewhere in this description, and performing by an authentication server some or all steps of any of the methods for verifying a dynamic authentication credential described elsewhere in this description.
- the method comprises performing during an authentication stage the steps of: obtaining, by an authentication client, a dynamic variable client value; obtaining, by an authentication client, a cryptographic credential generation key client value; retrieving, by the authentication client, from memory a passcode-blinding data element value; receiving, by the authentication client, a passcode value from the user; calculating, by the authentication client, a passcode verifier data element client value as a first irreversible client function of the retrieved passcode-blinding data element value and the received passcode value; calculating, by the authentication client, a dynamic authentication credential as a second irreversible client function of the obtained dynamic variable client value, the obtained cryptographic credential generation key client value and the calculated passcode verifier data element client value; and, receiving, by an authentication server, the dynamic authentication credential; obtaining, by the authentication server, a dynamic variable server value; obtaining, by the authentication server, a cryptographic credential generation key server value; obtaining, by the authentication server, a passcode verifier data element server value
- the method may further comprise the step of generating, by the authentication server, a signal indicating whether the received dynamic authentication credential matches the calculated credential reference value.
- the method may further comprise the step of the computer-based application performing a first action if the received dynamic authentication credential matches the calculated credential reference value and a second action if the received dynamic authentication credential doesn't match the calculated credential reference value.
- the dynamic variable client value may be the same as the dynamic variable server value
- the cryptographic credential generation key client value may be the same as the cryptographic credential generation key server value
- the passcode verifier data element client value may be the same as the passcode verifier data element server value
- the second irreversible client function for calculating the dynamic authentication credential may be substantially the same as the irreversible server function for calculating the credential reference value.
- the second irreversible client function for calculating the dynamic authentication credential being substantially the same as the irreversible server function may be understood as meaning that if the second irreversible client function and the irreversible server function are applied to the same set of input data, then the result of applying the second irreversible client function will match the result of applying the irreversible server function.
- the dynamic variable client value may be based on transaction data representing a transaction to be authorized by the user and the method may further comprise the steps of representing, by the authentication client, the transaction data to the user and receiving, by the authentication client from the user an approval of the represented transaction data.
- the step of calculating the dynamic authentication credential may be conditional on the user approving the represented transaction data.
- the method may further comprise the step of the computer-based application accepting the transaction if the received dynamic authentication credential matches the calculated credential reference value and rejecting the transaction if the received dynamic authentication credential doesn't match the calculated credential reference value.
- the method may further comprise performing during the authentication stage the steps of: storing, by the authentication client, a current state variable client value, whereby obtaining, by the authentication client, the cryptographic credential generation key client value may comprise deriving, by the authentication client, the cryptographic credential generation key client value from the stored current state variable client value; calculating, by the authentication client, a new state variable client value, as a third irreversible client function of the current state variable client value; discarding, by the authentication client, the cryptographic credential generation key client value after the calculation of the dynamic authentication credential; discarding, by the authentication client, the current state variable client value after the calculation of the new state variable client value and the derivation of the cryptographic credential generation key client value; storing, by the authentication client, the new state variable client value in place of the discarded current state variable client value; and storing, by the authentication server, a current state variable server value, whereby obtaining, by the authentication server, the cryptographic credential generation key server value may comprise deriving, by the authentication server,
- the method may further comprise performing during an initialization stage prior to the authentication stage the steps of: generating, by the authentication client, in an unpredictable way the passcode-blinding data element value; storing, by the authentication client, the generated passcode-blinding data element value for subsequent use during the authentication stage; receiving, by the authentication client, an initial passcode value from the user; calculating, by the authentication client, the (initial) passcode verifier data element client value as the first irreversible client function of the passcode-blinding data element value and the received initial passcode value; and receiving, by the authentication server, the calculated (initial) passcode verifier data element client value and storing, by the authentication server, the received (initial) passcode verifier data element client value as the passcode verifier data element server value for subsequent use during the authentication stage.
- the method may further comprise performing during the initialization stage the steps of: obtaining, at the authentication client, an initial client value for the state variable client value that is derived from an initial state seed, and storing, at the authentication client, the obtained initial value for the state variable client value as the current state variable client value; and obtaining, at the authentication server, an initial server value for the state variable server value that is also derived from the initial state seed, and storing, at the authentication server, the obtained initial value for the state variable server value as the current state variable server value.
- the method may further comprise performing during the initialization stage the steps of: generating or otherwise obtaining an initial state seed; wherein obtaining, at the authentication client, an initial client value for the state variable client value may comprise: obtaining, at the authentication client, the initial state seed, and deriving, at the authentication client, from the initial state seed the initial client value for the state variable client value; and wherein obtaining, at the authentication server, an initial server value for the state variable server value that is also derived from the initial state seed may comprise: obtaining, at the authentication server, the initial state seed, and deriving, at the authentication server, from the initial state seed the initial server value for the state variable server value.
- generating the initial state seed may comprise generating the initial state seed as a high entropy value. In some embodiments generating the initial state seed may comprise using a random or pseudo-random number generated by a random or pseudo-random number generator. In some embodiments generating the initial state seed may be performed by a server such as the authentication server or a server associated with the authentication server.
- the method may further comprise performing, during the authentication stage, the step of synchronizing the state variable client value and the state variable server value.
- the step of synchronizing the state variable client value and the state variable server value may comprise receiving, by the authentication client, a synchronization data element indicative of the state variable server value, and updating, by the authentication client, the state variable client value based on the value of the received synchronization data element to synchronize the state variable client value with the state variable server value.
- the synchronization data element may comprise a counter value, which may for example indicate how many times the state variable server value has been updated.
- the step of synchronizing the state variable client value and the state variable server value may comprise receiving, by the authentication server, a synchronization data element indicative of the state variable client value, and updating, by the authentication server, the state variable server value based on the value of the received synchronization data element to synchronize the state variable server value with the state variable client value.
- the synchronization data element may comprise a counter value, which may for example indicate how many times the state variable client value has been updated.
- an apparatus for generating a dynamic authentication credential may comprise any of the authentication tokens or authentication clients described elsewhere in this description.
- the apparatus may comprise any of the apparatus ( 100 ) described in connection to figure 1 .
- the apparatus may be adapted to perform any of the methods for generating a dynamic authentication credential described elsewhere in this description.
- the apparatus ( 100 ) may comprise: a user input interface ( 120 ) adapted to receive a passcode from a user of the apparatus; a data processor ( 150 ) adapted to perform cryptographic calculations; and a memory ( 160 ) for storing a passcode-blinding data element value and a state variable value; whereby the apparatus may be adapted to, in an initialization stage: obtain and store in the memory the passcode-blinding data element value and obtain an initial value for the state variable value and store in the memory the initial value as the current state variable value; and whereby the apparatus may be further adapted to, in an authentication stage: obtain a dynamic variable value; receive through the user input interface the passcode of the user; read from memory the passcode-blinding data element value; calculate a passcode verifier data element value as a first irreversible function of the received passcode and the passcode-blinding data element value; read from memory the current state variable value and derive a cryptographic credential generation key from the current state variable value read from memory;
- the apparatus may further comprise a user output interface ( 130 ) for presenting data to the user.
- a user output interface 130
- the apparatus may be further adapted to: receive transaction data representative of a transaction to be approved by the user; present the received transaction data to the user through the user output interface; receive from the user an approval for the presented transaction data through the user input interface.
- the calculation of the dynamic authentication credential may be conditional on the apparatus receiving the approval of the user of the presented transaction data.
- the apparatus may be further adapted to make the generated dynamic authentication credential available for verification by an authentication server.
- the apparatus may be adapted to present the generated dynamic authentication credential to the user through the user output interface for the user to forward to the authentication server.
- the apparatus may be adapted to send the generated dynamic authentication credential directly or indirectly to the authentication server.
- the apparatus may further comprise a random or pseudo-random number generator and the apparatus may be further adapted to, in the initialization stage, obtain a random or pseudo-random number generated by the random or pseudo-random number generator and obtain the passcode-blinding data element value as a function of the random or pseudo-random number.
- an apparatus for verifying a dynamic authentication credential may comprise any of the authentication servers described elsewhere in this description. In some embodiments the apparatus may be adapted to perform any of the methods for verifying a dynamic authentication credential described elsewhere in this description.
- the apparatus may comprise: a memory adapted to store at least one data set that is associated with a particular user or a particular authentication client, and a data processing component adapted to perform cryptographic operations; and the apparatus may be adapted to, in an authentication stage: receive a dynamic authentication credential; obtain a dynamic variable server value; read from the memory a data set associated with a particular user or a particular authentication client; obtain from the read data set a cryptographic credential generation key server value; obtain from the read data set a passcode verifier data element server value; calculate a credential reference value as an irreversible server function of the obtained dynamic variable server value, the obtained passcode verifier data element server value and the obtained cryptographic credential generation key server value; compare the received dynamic authentication credential with the calculated credential reference value to verify whether the received dynamic authentication credential matches the calculated credential reference value.
- the apparatus may comprise an authentication server and the memory may comprise a database comprised in or accessible by the authentication server.
- the apparatus may further be adapted to, in the authentication stage: generate a signal indicating whether the received dynamic authentication credential matches the calculated credential reference value.
- the apparatus may be further adapted to store in the memory the passcode verifier data element server value as part of the data set associated with a particular user or a particular authentication client.
- the apparatus may be further adapted to store and maintain in the memory a current state variable server value as a part of the data set associated with the particular user or the particular authentication client, and to, in the authentication stage: obtain the current state variable server value from the read data set; determine the cryptographic credential generation key server value as a function of the obtained current state variable server value; discard the cryptographic credential generation key server value after the calculation of the credential reference value; calculate a new state variable server value as a second irreversible server function of the obtained current state variable server value; discard the current state variable server value after the determination of the cryptographic credential generation key server value and the calculation of the new state variable server value; and write in the memory the new state variable server value in place of the current state variable server value as a part of the data set associated with the particular user or the particular authentication client.
- the apparatus may be further adapted to, in an initialization stage: receive a passcode verifier data element value and write the received passcode verifier data element value in the memory as the passcode verifier data element server value as part of the data set associated with the particular user or the particular authentication client.
- the apparatus may be further adapted to, in an initialization stage: obtain an initial state variable server value and write the initial state variable server value in the memory as the current state variable server value as part of the data set associated with the particular user or the particular authentication client.
- a system for securing a user's interaction with a computer-based application may comprise any of the systems described elsewhere in this description.
- the system may comprise any of the systems described in connection to figure 2 .
- the system may comprise a plurality of any of the authentication tokens or authentication clients described elsewhere in this description, and any of the authentication servers described elsewhere in this description.
- the system may comprise any of the apparatus for generating a dynamic authentication credential described elsewhere in this description, and any of the apparatus for verifying a dynamic authentication credential described elsewhere in this description.
- the system may be adapted to perform one or more steps of any of the methods for securing a user's interaction with a computer-based application described elsewhere in this application.
- the system ( 200 ) may comprise an authentication client (220) and an authentication server ( 230 ), whereby the authentication client may comprise: a user input interface ( 120 ) adapted to receive a passcode from a user of the authentication client; a client data processor ( 150 ) adapted to perform cryptographic calculations; and a client memory ( 160 ) for storing a passcode-blinding data element value and a state variable client value; whereby the authentication client may be adapted to, in an initialization stage: obtain and store in the memory the passcode-blinding data element value and obtain an initial client value for the state variable client value and store in the memory the initial client value as the current state variable client value; and whereby the authentication client may be further adapted to, in an authentication stage: obtain a dynamic variable client value; receive through the user input interface the passcode of the user; read from the client memory the passcode-blinding data element value; calculate a passcode verifier data element client value as a first irreversible client function of the received passcode and the passcode
- the dynamic variable may be based on a time value
- the authentication client may be adapted to obtain the dynamic variable client value as a function of a time value of a client clock comprised in the authentication client
- the authentication server may be adapted to obtain the dynamic variable server value as a function of a time value of a server clock comprised in the authentication server, whereby the client clock and the server clock may be synchronized.
- the dynamic variable may be based on a counter
- the authentication client may be adapted to obtain the dynamic variable client value as a function of a client counter value maintained by the authentication client
- the authentication server may be adapted to obtain the dynamic variable server value as a function of a server counter value maintained by the authentication server, whereby the authentication client and the authentication server may be adapted to synchronize the client counter value and the server counter value.
- the dynamic variable may be based on a value, such as challenge, and the authentication server may be adapted to generate this value and obtain the dynamic variable server value as a function of this value and send this value to the authentication client, and the authentication client may be adapted to receive this value (e.g., as input provided by the user or comprised in a message received from the authentication server), and obtain the dynamic variable client value as a function of this value.
- a value such as challenge
- the authentication server may be adapted to generate this value and obtain the dynamic variable server value as a function of this value and send this value to the authentication client
- the authentication client may be adapted to receive this value (e.g., as input provided by the user or comprised in a message received from the authentication server), and obtain the dynamic variable client value as a function of this value.
- the dynamic variable may be based on transaction data
- the authentication server may be adapted to receive the transaction data, e.g., from an computer-based application handling the transaction, and obtain the dynamic variable server value as a function of the transaction data
- the authentication client may be adapted to receive the transaction data (e.g., as input provided by the user or comprised in a message received from the authentication server or the computer-based application), and obtain the dynamic variable client value as a function of the transaction data.
- system may further comprise an application server adapted to host the computer-based application and the authentication server may further be adapted to, in the authentication stage: signal to the computer-based application whether the received dynamic authentication credential matches the calculated credential reference value; and the computer-based application may be adapted to perform one action if the received dynamic authentication credential matches the calculated credential reference value and another action if the received dynamic authentication credential doesn't match the calculated credential reference value.
- the computer-based application may grant a login request or may grant the user access to certain data or may authorize the user to perform certain actions or may perform a certain transaction which may have been submitted by the user if the received dynamic authentication credential matches the calculated credential reference value, and the computer-based application may refuse to perform these actions if the received dynamic authentication credential doesn't match the calculated credential reference value.
- an irreversible function may comprise a one-way function, i.e., a mathematical function for which it is computationally easy to calculate the result given the input date, but for which it is computationally hard to obtain matching input date given a particular value of the result of the function.
- Computationally easy may mean in some embodiments that it takes less than 5 seconds on the electronic device that is meant to do the calculations, to obtain the result of the function.
- Computationally hard may mean in some embodiments that it takes at least a factor of a million more computational effort to obtain matching input date given a particular value of the result of the function than it takes to calculate the result given the input date.
- Computationally hard may mean in some embodiments that the only known way to obtain matching input date given a particular value of the result of the function is by an exhaustive search.
- a cryptographic encryption or decryption operation parameterized by a secret key may also be considered to be an irreversible function, since it may be computationally hard to undo an encryption or decryption operation on an input data element if the value of the parameterizing secret key is unknown.
- a passcode value is stored on some component of an authentication system, it may be compromised by, for example, an attacker capable of accessing the memory of such a component. Since the passcode typically may have a relatively low entropy, it could potentially also be vulnerable to a brute force exhaustive search attack if an attacker obtains the value of a data element that is a function of the passcode.
- the invention improves on other methods and systems for securing a user's interaction with a computer-based application that are based on dynamic credentials and use a passcode, in that it protects the confidentiality of the passcode value against various attacks.
- a dynamic authentication credential is generated as a function of a passcode value
- the value of a dynamic authentication credential could be used as a starting point for an exhaustive search attack to retrieve the value of the passcode.
- the dynamic authentication credential is calculated as an irreversible function of not only the passcode value but also the high entropy passcode-blinding data element value and the high entropy cryptographic credential generation key value, such an exhaustive search attack would be computationally infeasible.
- a passcode verifier data element is generated as a function of a passcode value
- the value of a passcode verifier data element could be used as a starting point for an exhaustive search attack to retrieve the value of the passcode.
- the passcode verifier data element is calculated as an irreversible function of not only the passcode value but also the high entropy passcode-blinding data element value, such an exhaustive search attack would be computationally infeasible. Therefore, knowledge of a passcode verifier data element by itself does not permit to obtain the value of a passcode.
- the cryptographic credential generation key value on the one hand and the values of the passcode and the passcode verifier data element on the other hand are independent of each other, also the combined knowledge of both a passcode verifier data element value and a corresponding cryptographic credential generation key value by itself does not permit to obtain the value of a passcode. Therefore, an attacker who gets hold of a passcode verifier data element value and/or a corresponding cryptographic credential generation key value stored at an authentication server can still not obtain the user's passcode.
- the value of a dynamic authentication credential is fully determined by (and therefore doesn't add any information to) the combination of the values of a passcode verifier data element value and a corresponding cryptographic credential generation key value, even an attacker who has intercepted the value of a dynamic authentication credential and who has got hold of the corresponding passcode verifier data element value and/or the corresponding cryptographic credential generation key value stored at an authentication server can still not obtain the user's passcode.
- a dynamic authentication credential value is a function of the passcode value, the dynamic variable value, the passcode-blinding data element value and the cryptographic credential generation key value, and since a dynamic variable value could be either easy to obtain or to guess or could have in practice a low entropy, an attacker who could get hold of on the one hand a dynamic authentication credential value and on the other hand both the passcode-blinding data element value and the cryptographic credential generation key value that were used in the generation of that dynamic authentication credential value, could use that dynamic credential value to mount a potentially feasible exhaustive search attack.
- an authentication token or authentication client discards both any cryptographic credential generation key value and the value of the state variable from which this particular cryptographic credential generation key value may have been derived after it has used that cryptographic credential generation key value to generate a dynamic authentication credential, even an attacker who gets hold of both on the one hand the values of the passcode-blinding data element, the cryptographic credential generation key and the state variable stored in a particular authentication token or authentication client and on the other hand the values of any or all dynamic authentication credentials that had been generated up to that point by that particular authentication token or authentication client, still doesn't have the combination of on the one hand a dynamic authentication credential value and on the other hand both the passcode-blinding data element value and the particular cryptographic credential generation key value that were used in the generation of that dynamic authentication credential value, and therefore could still not mount a feasible exhaustive search attack to retrieve the passcode of the user of that particular authentication token or authentication client.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
- Radar Systems Or Details Thereof (AREA)
Claims (13)
- Verfahren zum Sichern der Interaktion eines Benutzers (290) mit einer computerbasierten Anwendung, umfassend:Durchführen, durch einen Authentifizierungs-Client, während einer Initialisierungsphase vor einer Authentifizierungsphase der folgenden Schritte:Generieren eines Passcode-Blinding-Datenelementwerts;Speichern des generierten Passcode-Blinding-Datenelementwerts zur späteren Verwendung während der Authentifizierungsphase, wobei das Passcode-Blinding-Datenelement nicht auf dem Authentifizierungs-Server gespeichert wird;Empfangen eines anfänglichen Passcode-Werts von dem Benutzer; undBerechnen eines Passcode-Verifizierungsdatenelement-Client-Werts als eine erste irreversible Client-Funktion des Passcode-Blinding-Datenelementwerts und des empfangenen anfänglichen Passcode-Werts;Durchführen, durch einen Authentifizierungs-Server, während der Initialisierungsphase, der folgenden Schritte:Empfangen des berechneten Passcode-Verifizierungsdatenelement-Client-Werts; undSpeichern des empfangenen Passcode-Verifizierungsdatenelement-Client-Werts als einen Passcode-Verifizierungsdatenelement-Server-Wert für spätere Verwendung während der Authentifizierungsphase;Durchführen, durch den Authentifizierungs-Client (100; 220), während der Authentifizierungsphase, der folgenden Schritte:Erhalten eines dynamischen variablen Client-Werts;Erhalten eines kryptographischen Credential-Generierungsschlüssel-Client-Werts;Abrufen (320), aus dem Speicher, eines Passcode-Blinding-Datenelementwerts;Empfangen (310) eines Passcode-Werts von dem Benutzer;Berechnen (330) eines Passcode-Verifizierungsdatenelement-Client-Werts als eine erste irreversible Client-Funktion des abgerufenen Passcode-Blinding-Datenelementwerts und des empfangenen Passcode-Werts;Berechnen (340) eines dynamischen Authentifizierungs-Credentials als eine zweite irreversible Client-Funktion des erhaltenen dynamischen variablen Client-Werts, des erhaltenen kryptographischen Credential-Generierungsschlüssel-Client-Werts und des berechneten Passcode-Verifizierungsdatenelement-Client-Werts; undDurchführen, durch den Authentifizierungs-Server (230), während der Authentifizierungsphase, der folgenden Schritte:Empfangen (410) des dynamischen Authentifizierungs-Credentials;Erhalten (420) eines dynamischen variablen Server-Werts;Erhalten (430) eines kryptographischen Credential-Generierungsschlüssel-Server-Werts;Erhalten (430) des Passcode-Verifizierungsdatenelement-Server-Werts;Berechnen (440) eines Credential-Referenzwerts als eine erste irreversible Server-Funktion des erhaltenen dynamischen variablen Server-Werts, des erhaltenen kryptographischen Credential-Generierungsschlüsssel-Server-Werts und des erhaltenen Passcode-Verifizierungsdatenelement-Server-Werts;Verifizieren (450), ob das empfangene dynamische Authentifizierungs-Credential mit dem berechneten Credential-Referenzwert übereinstimmt.
- Verfahren nach Anspruch 1, wobei der dynamische variable Client-Wert der gleiche ist wie der dynamische variable Server-Wert, der kryptographische Credential-Generierungsschlüssel-Client-Wert der gleiche ist wie der kryptographische Credential-Generierungsschlüssel-Server-Wert, der Passcode-Verifizierungsdatenelement-Client-Wert der gleiche ist wie der Passcode-Verifizierungsdatenelement-Server-Wert und die zweite Client-Funktion zum Berechnen des dynamischen Authentifizierungs-Credentials der ersten Server-Funktion zum Berechnen des Credential-Referenzwerts im Wesentlichen gleich ist.
- Verfahren nach Anspruch 1 oder Anspruch 2, wobei der dynamische variable Client-Wert auf Transaktionsdaten basiert, die eine von dem Benutzer zu autorisierende Transaktion darstellen und das Verfahren ferner die folgenden Schritte umfasst:
Darstellen, durch den Authentifizierungs-Client, der Transaktionsdaten an den Benutzer; und Empfangen, durch den Authentifizierungs-Client, von dem Benutzer, einer Genehmigung der dargestellten Transaktionsdaten. - Verfahren nach einem der Ansprüche 1 bis 3, ferner umfassend:Durchführen, durch den Authentifizierungs-Client, während der Authentifizierungsphase, der folgenden Schritte:Speichern eines aktuellen zustandsvariablen Client-Werts, wobei Erhalten des kryptographischen Credential-Generierungsschlüssel-Client-Werts Ableiten, durch den Authentifizierungs-Client, des kryptographischen Credential-Generierungsschlüssel-Client-Werts aus dem gespeicherten aktuellen zustandsvariablen Client-Wert umfasst;Berechnen eines neuen zustandsvariablen Client-Werts als eine dritte Client-Funktion des aktuellen zustandsvariablen Client-Werts;Speichern des neuen zustandsvariablen Client-Werts anstelle des aktuellen zustandsvariablen Client-Werts; undDurchführen, durch den Authentifizierungs-Server, während der Authentifizierungsphase, der folgenden Schritte:Speichern eines aktuellen zustandsvariablen Werts, wobei das Erhalten, durch den Authentifizierungs-Server, des kryptographischen Credential-Generierungsschlüssel-Server-Werts Ableiten, durch den Authentifizierungs-Server, des kryptographischen Credential-Generierungsschlüssel-Server-Werts aus dem gespeicherten aktuellen zustandsvariablen Server-Wert umfasst; Berechnen eines neuen zustandsvariablen Server-Werts als eine zweite Server-Funktion des aktuellen zustandsvariablen Server-Werts;Speichern des neuen zustandsvariablen Server-Werts anstelle des aktuellen zustandsvariablen Server-Werts.
- Verfahren nach Anspruch 4, wobei die dritte Client-Funktion und die zweite Server-Funktion irreversible Funktionen sind.
- Verfahren nach Anspruch 4 oder 5, ferner umfassendDurchführen, durch den Authentifizierungs-Client, während der Authentifizierungsphase, der folgenden Schritte:Verwerfen des kryptographischen Credential-Generierungsschlüssel-Client-Werts nach der Berechnung des dynamischen Authentifizierungs-Credentials;Verwerfen des aktuellen zustandsvariablen Client-Werts nach dem Berechnen des neuen zustandsvariablen Client-Werts und der Ableitung des kryptographischen Credential-Generierungsschlüssel-Client-Werts; undDurchführen, durch den Authentifizierungs-Server, während der Authentifizierungsphase, der folgenden Schritte:Verwerfen des kryptographischen Credential-Generierungsschlüssel-Server-Werts nach der Berechnung des Credential-Referenzwerts;Verwerfen des aktuellen zustandsvariablen Server-Werts nach dem Berechnen des neuen zustandsvariablen Server-Werts und der Ableitung des kryptographischen Credential-Generierungsschlüssel-Server-Werts.
- Verfahren nach einem der Ansprüche 4 bis 6, wobei der aktuelle zustandsvariable Server-Wert der gleiche ist wie der aktuelle zustandsvariable Client-Wert, der neue zustandsvariable Server-Wert der gleiche ist wie der neue zustandsvariable Client-Wert und die zweite Server-Funktion die gleiche ist wie die dritte Client-Funktion.
- Verfahren nach einem der Ansprüche 4 bis 7, ferner umfassend Durchführen, während der Initialisierungsphase, der folgenden Schritte:Erhalten, an dem Authentifizierungs-Client, eines anfänglichen Client-Werts für den zustandsvariablen Client-Wert, der aus einem anfänglichen Zustands-Seed abgeleitet wird;Speichern, an dem Authentifizierungs-Client, des erhaltenen anfänglichen Werts für den zustandsvariablen Client-Wert als den aktuellen zustandsvariablen Client-Wert;Erhalten, an dem Authentifizierungs-Server, eines anfänglichen Server-Werts für den zustandsvariablen Server-Wert, der aus dem anfänglichen Zustands-Seed abgeleitet wird; undSpeichern, an dem Authentifizierungs-Server, des erhaltenen anfänglichen Werts für den zustandsvariablen Server-Wert als den aktuellen zustandsvariablen Server-Wert.
- Verfahren nach einem der Ansprüche 4 bis 8, ferner den folgenden Schritt umfassend:
Synchronisieren des zustandsvariablen Client-Werts und des zustandsvariablen Server-Werts während der Authentifizierungsphase. - Vorrichtung (100) zum Generieren eines dynamischen Authentifizierungs-Credentials zum Verifizieren durch einen Authentifizierungs-Server (230), wobei die Vorrichtung umfasst:eine Benutzereingabeschnittstelle (120), die dafür ausgelegt ist, einen Passcode von einem Benutzer (290) der Vorrichtung zu empfangen;einen Datenprozessor (150), der dafür ausgelegt ist, kryptographische Berechnungen durchzuführen; undeinen Speicher (160) zum Speichern eines Passcode-Blinding-Datenelementwerts; wobei die Vorrichtung für das Folgende in einer Initialisierungsphase ausgelegt ist:
Erhalten und Speichern in dem Speicher des Passcode-Blinding-Datenelementwerts, wobei das Passcode-Blinding-Datenelement nicht auf dem Authentifizierungs-Server gespeichert wird; undwobei die Vorrichtung ferner für das Folgende in einer Authentifizierungsphase ausgelegt ist:Erhalten eines dynamischen variablen Werts; Empfangen (310), durch die Benutzereingabeschnittstelle, des Passcodes des Benutzers; Lesen (320), aus dem Speicher, des Passcode-Blinding-Datenelementwerts; Berechnen (330) eines Passcode-Verifizierungsdatenelementwerts als eine erste irreversible Funktion des empfangenen Passcodes und des Passcode-Blinding-Datenelementwerts;Erhalten eines kryptographischen Credential-Generierungsschlüssels; Berechnen (340) eines dynamischen Authentifizierungs-Credentials als eine zweite irreversible Funktion des erhaltenen dynamischen variablen Werts, des berechneten Passcode-Verifizierungsdatenelementwerts und des erhaltenen kryptographischen Credential-Generierungsschlüssels. - Vorrichtung nach Anspruch 10, die ferner für das Folgende in der Initialisierungsphase ausgelegt ist:Erhalten eines anfänglichen Werts für einen zustandsvariablen Wert und Speichern des anfänglichen Werts in dem Speicher als den aktuellen zustandsvariablen Wert; undferner für das Folgende in der Authentifizierungsphase ausgelegt ist:
Lesen aus dem Speicher des aktuellen zustandsvariablen Werts und Erhalten des kryptographischen Credential-Generierungsschlüssels durch Ableiten des kryptographischen Credential-Generierungsschlüssels aus dem aktuellen zustandsvariablen Wert, der aus dem Speicher gelesen wird; Verwerfen des abgeleiteten kryptographischen Credential-Generierungsschlüssels nach Berechnen des dynamischen Authentifizierungs-Credentials; Generieren eines neuen Werts für den zustandsvariablen Wert als eine dritte irreversible Funktion des aktuellen zustandsvariablen Werts; und, nach dem Ableiten des kryptographischen Credential-Generierungsschlüssels aus dem aktuellen zustandsvariablen Wert und der Generierung des neuen Werts des zustandsvariablen Werts, Verwerfen des aktuellen zustandsvariablen Werts und Speichern des generierten neuen Werts des zustandsvariablen Werts anstelle des aktuellen zustandsvariablen Werts. - Vorrichtung nach Anspruch 10 oder 11, ferner eine Benutzerausgabeschnittstelle zum Darstellen von Daten an den Benutzer umfassend, und ferner für das Folgende ausgelegt: Empfangen von Transaktionsdaten, die für eine durch den Benutzer zu genehmigende Transaktion repräsentativ sind; Darstellen der empfangenen Transaktionsdaten an den Benutzer durch die Benutzerausgabeschnittstelle; Empfangen, von dem Benutzer, einer Genehmigung für die dargestellten Transaktionsdaten durch die Benutzereingabeschnittstelle.
- System (200) zum Sichern der Interaktion eines Benutzers (290) mit einer computerbasierten Anwendung, umfassend:einen Authentifizierungs-Client (100; 220); undeinen Authentifizierungs-Server (230);wobei der Authentifizierungs-Client (100; 220) umfasst:eine Benutzereingabeschnittstelle (100), die dafür ausgelegt ist, einen Passcode von einem Benutzer des Authentifizierungs-Clients zu empfangen;einen Client-Datenprozessor (150), der dafür ausgelegt ist, kryptographische Berechnungen durchzuführen; undeinen Client-Speicher (160) zum Speichern eines Passcode-Blinding-Datenelementwerts und eines zustandsvariablen Werts;wobei der Authentifizierungs-Client (100; 220) für das Folgende in einer Initialisierungsphase ausgelegt ist:
Erhalten und Speichern in dem Speicher des Passcode-Blinding-Datenelementwerts, wobei das Passcode-Blinding-Datenelement nicht auf dem Authentifizierungs-Server gespeichert wird, und Erhalten eines anfänglichen Client-Werts für den zustandsvariablen Client-Wert und Speichern in dem Speicher des anfänglichen Client-Werts als den aktuellen zustandsvariablen Client-Wert; undwobei der Authentifizierungs-Client (100; 200) ferner für das Folgende in einer Authentifizierungsphase ausgelegt ist:
Erhalten eines dynamischen variablen Client-Werts; Empfangen (310), durch die Benutzereingabeschnittstelle, des Passcodes des Benutzers; Lesen (320), aus dem Client-Speicher, des Passcode-Blinding-Datenelementwerts; Berechnen (330) eines Passcode-Verifizierungsdatenelement-Client-Werts als eine erste irreversible Client-Funktion des empfangenen Passcodes und des Passcode-Blinding-Datenelementwerts; Lesen aus dem Client-Speicher des aktuellen zustandsvariablen Client-Werts und Ableiten eines kryptographischen Credential-Generierungsschlüssel-Client-Werts aus dem aktuellen zustandsvariablen Client-Wert, der aus dem Client-Speicher gelesen wurde; Berechnen (340) eines dynamischen Authentifizierungs-Credentials als eine zweite irreversible Client-Funktion des erhaltenen dynamischen variablen Client-Werts, des berechneten Passcode-Verifizierungsdatenelement-Client-Werts und des abgeleiteten kryptographischen Credential-Generierungsschlüssel-Client-Werts; Verwerfen des abgeleiteten kryptographischen Credential-Generierungsschlüssel-Client-Werts nach Berechnen des dynamischen Authentifizierungs-Credentials; Generieren eines neuen Werts für den zustandsvariablen Client-Wert als eine dritte irreversible Client-Funktion des aktuellen zustandsvariablen Client-Werts; und, nach der Ableitung des kryptographischen Credential-Generierungsschlüssel-Client-Werts aus dem aktuellen zustandsvariablen Client-Wert und der Generierung des neuen Werts des zustandsvariablen Client-Werts, Verwerfen des aktuellen zustandsvariablen Client-Werts und Speichern des generierten neuen Werts des zustandsvariablen Client-Werts anstelle des aktuellen zustandsvariablen Client-Werts; undwobei der Authentifizierungs-Server (230) umfasst:einen Server-Speicher, der dafür ausgelegt ist, einen Datensatz zu speichern, der dem Benutzer oder dem Authentifizierungs-Client zugeordnet ist, undeine Server-Datenverarbeitungskomponente, die dafür ausgelegt ist, kryptographische Operationen durchzuführen; undwobei der Authentifizierungs-Server (230) für das Folgende in der Initialisierungsphase ausgelegt ist: Empfangen eines Passcode-Verifizierungsdatenelementinitialisierungswerts und Schreiben des empfangenen Passcode-Verifizierungsdatenelementinitialisierungswerts in den Speicher als einen Passcode-Verifizierungsdatenelement-Server-Wert als Teil des Datensatzes, der dem Benutzer oder dem Authentifizierungs-Client zugeordnet ist; und Erhalten eines anfänglichen zustandsvariablen Server-Werts und Schreiben des anfänglichen zustandsvariablen Server-Werts in den Speicher als einen aktuellen zustandsvariablen Server-Wert als Teil des Datensatzes, der dem Benutzer oder dem Authentifizierungs-Client zugeordnet ist; undwobei der Authentifizierungs-Server (230) ferner für das Folgende in der Authentifizierungsphase ausgelegt ist:Empfangen des generierten dynamischen Authentifizierungs-Credentials; Erhalten eines dynamischen variablen Server-Werts; Lesen aus dem Server-Speicher des Datensatzes, der dem Benutzer oder dem Authentifizierungs-Client zugeordnet ist; Erhalten des aktuellen zustandsvariablen Server-Werts aus dem gelesenen Datensatz; Ableiten eines kryptographischen Credential-Generierungsschlüssel-Server-Werts als eine Funktion des erhaltenen aktuellen zustandsvariablen Server-Werts;Erhalten aus dem Datensatz des Passcode-Verifikations-Datenelement-Server-Werts; Berechnen eines Credential-Referenzwerts als eine erste irreversible Server-Funktion des erhaltenen dynamischen variablen Server-Werts, des erhaltenen Passcode-Verifikations-Datenelement-Server-Werts und des abgeleiteten kryptographischen Credential-Generierungsschlüssel-Server-Werts; Verifizieren, ob das empfangene dynamische Authentifizierungs-Credential mit dem berechneten Credential-Referenzwert übereinstimmt; Verwerfen des kryptographischen Credential-Generierungsschlüssel-Server-Werts nach der Berechnung des Credential-Referenzwerts; Berechnen eines neuen zustandsvariablen Server-Werts als eine zweite irreversible Server-Funktion des erhaltenen aktuellen zustandsvariablen Server-Werts; Verwerfen des aktuellen zustandsvariablen Server-Werts nach dem Ableiten des kryptographischen Credential-Generierungsschlüssel-Server-Werts und dem Berechnen des neuen zustandsvariablen Server-Werts; und Schreiben in den Server-Speicher des neuen zustandsvariablen Server-Werts anstelle des aktuellen zustandsvariablen Server-Werts als einen Teil des Datensatzes, der dem Benutzer oder dem Authentifizierungs-Client zugeordnet ist.
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201562273138P | 2015-12-30 | 2015-12-30 | |
PCT/US2016/069464 WO2017117520A1 (en) | 2015-12-30 | 2016-12-30 | A method, system and apparatus using forward-secure cryptography for passcode verification |
Publications (3)
Publication Number | Publication Date |
---|---|
EP3398289A1 EP3398289A1 (de) | 2018-11-07 |
EP3398289C0 EP3398289C0 (de) | 2023-06-07 |
EP3398289B1 true EP3398289B1 (de) | 2023-06-07 |
Family
ID=57799953
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP16826678.1A Active EP3398289B1 (de) | 2015-12-30 | 2016-12-30 | Verfahren, system und vorrichtung mit vorwärtssicherer kryptografie zur passcodeüberprüfung |
Country Status (6)
Country | Link |
---|---|
US (1) | US10511438B2 (de) |
EP (1) | EP3398289B1 (de) |
JP (1) | JP6927981B2 (de) |
CN (1) | CN109075965B (de) |
ES (1) | ES2952534T3 (de) |
WO (1) | WO2017117520A1 (de) |
Families Citing this family (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE102014015814B4 (de) * | 2014-10-24 | 2016-05-04 | Unify Gmbh & Co. Kg | Verfahren zum Authentifizieren eines Benutzergeräts bei der Anmeldung an einem Server |
EP3376421A1 (de) * | 2017-03-17 | 2018-09-19 | Gemalto Sa | Verfahren zur authentifizierung eines benutzers und zugehörige vorrichtung, erste und zweite server und system |
JP2019054466A (ja) * | 2017-09-15 | 2019-04-04 | 株式会社 エヌティーアイ | 通信システム、第1通信装置、第2通信装置、方法、コンピュータプログラム |
WO2019147251A1 (en) * | 2018-01-25 | 2019-08-01 | Visa International Service Association | Token offline provisioning |
US10389708B1 (en) * | 2019-01-03 | 2019-08-20 | Capital One Services, Llc | Secure authentication of a user associated with communication with a service representative |
GB2585010B (en) * | 2019-06-24 | 2022-07-13 | Blockstar Developments Ltd | Cryptocurrency key management |
FR3105481B1 (fr) * | 2019-12-24 | 2022-12-16 | Thales Sa | Procédé de vérification du mot de passe d'un dongle, programme d'ordinateur, dongle et terminal utilisateur associés |
JP2021141460A (ja) * | 2020-03-05 | 2021-09-16 | キヤノン株式会社 | 被認証装置、認証システムおよび認証方法 |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9218476B1 (en) * | 2012-11-07 | 2015-12-22 | Amazon Technologies, Inc. | Token based one-time password security |
US9225717B1 (en) * | 2013-03-14 | 2015-12-29 | Emc Corporation | Event-based data signing via time-based one-time authentication passcodes |
Family Cites Families (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7085840B2 (en) * | 2001-10-29 | 2006-08-01 | Sun Microsystems, Inc. | Enhanced quality of identification in a data communications network |
US8281378B2 (en) * | 2006-10-20 | 2012-10-02 | Citrix Systems, Inc. | Methods and systems for completing, by a single-sign on component, an authentication process in a federated environment to a resource not supporting federation |
CN101163014A (zh) * | 2007-11-30 | 2008-04-16 | 中国电信股份有限公司 | 一种动态口令身份认证***和方法 |
US20090210712A1 (en) | 2008-02-19 | 2009-08-20 | Nicolas Fort | Method for server-side detection of man-in-the-middle attacks |
US8302167B2 (en) * | 2008-03-11 | 2012-10-30 | Vasco Data Security, Inc. | Strong authentication token generating one-time passwords and signatures upon server credential verification |
KR101486782B1 (ko) * | 2010-06-27 | 2015-01-28 | 킹 사우드 유니버시티 | 무한 중첩된 해시 체인들에 의한 1회용 패스워드 인증 |
US8832807B1 (en) * | 2010-08-05 | 2014-09-09 | Christine E. Kuo | Method and apparatus for asynchronous dynamic password |
US8756706B2 (en) * | 2010-10-12 | 2014-06-17 | Blackberry Limited | Method for securing credentials in a remote repository |
US8683562B2 (en) * | 2011-02-03 | 2014-03-25 | Imprivata, Inc. | Secure authentication using one-time passwords |
PL2885904T3 (pl) * | 2012-08-03 | 2018-09-28 | Vasco Data Security International Gmbh | Dogodny dla użytkownika sposób uwierzytelniania i urządzenie stosujące mobilną aplikację uwierzytelniania |
US9124433B2 (en) * | 2012-12-28 | 2015-09-01 | Vasco Data Security, Inc. | Remote authentication and transaction signatures |
CN103258312B (zh) * | 2013-03-20 | 2015-10-28 | 东北大学 | 具有快速密钥流生成机制的数字图像加密方法 |
JP2017507549A (ja) * | 2013-12-30 | 2017-03-16 | バスコ データ セキュリティー インターナショナル ゲゼルシャフト ミット ベシュレンクテル ハフツング | ブルートゥースインタフェースを備える認証装置 |
WO2015103031A1 (en) * | 2013-12-31 | 2015-07-09 | Vasco Data Security, Inc. | A method and apparatus for securing a mobile application |
CN103916234B (zh) * | 2014-04-11 | 2016-09-07 | 中国人民解放军***总医院 | 一种应用于隐私保护的混沌医学图像加密方法 |
CN104753682B (zh) * | 2015-04-03 | 2019-05-14 | 北京奇虎科技有限公司 | 一种会话秘钥的生成***及方法 |
-
2016
- 2016-12-30 JP JP2018534587A patent/JP6927981B2/ja active Active
- 2016-12-30 US US15/395,659 patent/US10511438B2/en active Active
- 2016-12-30 WO PCT/US2016/069464 patent/WO2017117520A1/en active Application Filing
- 2016-12-30 EP EP16826678.1A patent/EP3398289B1/de active Active
- 2016-12-30 CN CN201680077508.9A patent/CN109075965B/zh active Active
- 2016-12-30 ES ES16826678T patent/ES2952534T3/es active Active
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9218476B1 (en) * | 2012-11-07 | 2015-12-22 | Amazon Technologies, Inc. | Token based one-time password security |
US9225717B1 (en) * | 2013-03-14 | 2015-12-29 | Emc Corporation | Event-based data signing via time-based one-time authentication passcodes |
Also Published As
Publication number | Publication date |
---|---|
JP6927981B2 (ja) | 2021-09-01 |
CN109075965B (zh) | 2022-02-15 |
EP3398289C0 (de) | 2023-06-07 |
WO2017117520A1 (en) | 2017-07-06 |
US10511438B2 (en) | 2019-12-17 |
ES2952534T3 (es) | 2023-11-02 |
CN109075965A (zh) | 2018-12-21 |
WO2017117520A8 (en) | 2018-08-30 |
JP2019506789A (ja) | 2019-03-07 |
EP3398289A1 (de) | 2018-11-07 |
US20170195316A1 (en) | 2017-07-06 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20230231718A1 (en) | Method of using one device to unlock another device | |
EP3398289B1 (de) | Verfahren, system und vorrichtung mit vorwärtssicherer kryptografie zur passcodeüberprüfung | |
CN106575326B (zh) | 利用非对称加密实施一次性密码的***和方法 | |
US9525549B2 (en) | Method and apparatus for securing a mobile application | |
CN111512608B (zh) | 基于可信执行环境的认证协议 | |
US8397281B2 (en) | Service assisted secret provisioning | |
Kaur et al. | A comparative analysis of various multistep login authentication mechanisms |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: UNKNOWN |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE |
|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE |
|
17P | Request for examination filed |
Effective date: 20180711 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
AX | Request for extension of the european patent |
Extension state: BA ME |
|
DAV | Request for validation of the european patent (deleted) | ||
DAX | Request for extension of the european patent (deleted) | ||
RIN1 | Information on inventor provided before grant (corrected) |
Inventor name: MURDOCH, STEVEN JAMES |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
17Q | First examination report despatched |
Effective date: 20200117 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R079 Ref document number: 602016080089 Country of ref document: DE Free format text: PREVIOUS MAIN CLASS: H04L0009080000 Ipc: H04L0009400000 |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: H04L 9/32 20060101ALI20220921BHEP Ipc: H04L 9/08 20060101ALI20220921BHEP Ipc: H04L 9/40 20220101AFI20220921BHEP |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: GRANT OF PATENT IS INTENDED |
|
INTG | Intention to grant announced |
Effective date: 20221111 |
|
GRAS | Grant fee paid |
Free format text: ORIGINAL CODE: EPIDOSNIGR3 |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE PATENT HAS BEEN GRANTED |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
REG | Reference to a national code |
Ref country code: GB Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: EP Ref country code: AT Ref legal event code: REF Ref document number: 1578046 Country of ref document: AT Kind code of ref document: T Effective date: 20230615 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R096 Ref document number: 602016080089 Country of ref document: DE |
|
U01 | Request for unitary effect filed |
Effective date: 20230707 |
|
U07 | Unitary effect registered |
Designated state(s): AT BE BG DE DK EE FI FR IT LT LU LV MT NL PT SE SI Effective date: 20230719 |
|
REG | Reference to a national code |
Ref country code: LT Ref legal event code: MG9D |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: NO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230907 |
|
REG | Reference to a national code |
Ref country code: ES Ref legal event code: FG2A Ref document number: 2952534 Country of ref document: ES Kind code of ref document: T3 Effective date: 20231102 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: RS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230607 Ref country code: HR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230607 Ref country code: GR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230908 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: SK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230607 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: GB Payment date: 20231227 Year of fee payment: 8 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20231007 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: SM Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230607 Ref country code: SK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230607 Ref country code: RO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230607 Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20231007 Ref country code: CZ Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230607 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: IE Payment date: 20231227 Year of fee payment: 8 |
|
U20 | Renewal fee paid [unitary effect] |
Year of fee payment: 8 Effective date: 20231227 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: PL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230607 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R097 Ref document number: 602016080089 Country of ref document: DE |
|
PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: ES Payment date: 20240102 Year of fee payment: 8 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: CH Payment date: 20240102 Year of fee payment: 8 |
|
26N | No opposition filed |
Effective date: 20240308 |